CVE-2026-32060
OpenClaw < 2026.2.14 - Path Traversal in apply_patch via Crafted Paths
OpenClaw versions prior to 2026.2.14 contain a path traversal vulnerability in apply_patch that allows attackers to write or delete files outside the configured workspace directory. When apply_patch is enabled without filesystem sandbox containment, attackers can exploit crafted paths including directory traversal sequences or absolute paths to escape workspace boundaries and modify arbitrary files.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
OpenClaw < 2026.2.14 - Path Traversal in apply_patch via Crafted Paths
OpenClaw versions prior to 2026.2.14 contain a path traversal vulnerability in apply_patch that allows attackers to write or delete files outside the configured workspace directory. When apply_patch is enabled without filesystem sandbox containment, attackers can exploit crafted paths including directory traversal sequences or absolute paths to escape workspace boundaries and modify arbitrary files.
- Record
CVE-2026-32060- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2026-11150
OpenClaw versions prior to 2026.2.14 contain a path traversal vulnerability in apply_patch that allows attackers to write or delete files outside the configured workspace directory. When apply_patch is enabled without filesystem sandbox containment, attackers can exploit crafted paths including directory traversal sequences or absolute paths to escape workspace boundaries and modify arbitrary files.
- Record
EUVD-2026-11150- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-r5fq-947m-xm57
OpenClaw has a path traversal in apply_patch could write/delete files outside the workspace
Summary
In affected versions, when apply_patch was enabled and the agent ran without filesystem sandbox containment, crafted paths could cause file writes/deletes outside the configured workspace directory.
Affected Packages / Versions
- Package:
openclaw(npm) - Affected:
<= 2026.2.13 - Fixed:
>= 2026.2.14
Details
The non-sandbox path resolution in apply_patch did not enforce workspace containment. Inputs like ../../... or absolute paths could escape the working directory in non-sandboxed mode.
Impact
Practical impact depends on deployment and who can trigger tool execution. This is most relevant when tool invocation is exposed to less-trusted callers or when operators expected workspace-only containment.
Workarounds
- Keep
tools.exec.applyPatch.enableddisabled if you do not needapply_patch. - Keep
tools.exec.applyPatch.workspaceOnlyat its secure default oftrue. - Restrict who can trigger tool execution (and which tools are allowlisted).
Configuration Note
tools.exec.applyPatch.workspaceOnly: false intentionally opts out of workspace containment and can re-enable outside-workspace writes/deletes.
Fix
- PR: https://github.com/openclaw/openclaw/pull/16405
- Merge commit:
5544646a09c0121fca7d7093812dc2de8437c7f1
Credits
Thanks to @p80n-sec for reporting this issue.
- Record
GHSA-r5fq-947m-xm57- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
NVD
OpenClaw versions prior to 2026.2.14 contain a path traversal vulnerability in apply_patch that allows attackers to write or delete files outside the configured workspace directory. When apply_patch is enabled without filesystem sandbox containment, attackers can exploit crafted paths including directory traversal sequences or absolute paths to escape workspace boundaries and modify arbitrary files.
- Record
CVE-2026-32060- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
OpenClaw < 2026.2.14 - Path Traversal in apply_patch via Crafted Paths
OpenClaw versions prior to 2026.2.14 contain a path traversal vulnerability in apply_patch that allows attackers to write or delete files outside the configured workspace directory. When apply_patch is enabled without filesystem sandbox containment, attackers can exploit crafted paths including directory traversal sequences or absolute paths to escape workspace boundaries and modify arbitrary files.
- Record
CVE-2026-32060- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVGHSA-r5fq-947m-xm57
OpenClaw has a path traversal in apply_patch could write/delete files outside the workspace
Summary
In affected versions, when apply_patch was enabled and the agent ran without filesystem sandbox containment, crafted paths could cause file writes/deletes outside the configured workspace directory.
Affected Packages / Versions
- Package:
openclaw(npm) - Affected:
<= 2026.2.13 - Fixed:
>= 2026.2.14
Details
The non-sandbox path resolution in apply_patch did not enforce workspace containment. Inputs like ../../... or absolute paths could escape the working directory in non-sandboxed mode.
Impact
Practical impact depends on deployment and who can trigger tool execution. This is most relevant when tool invocation is exposed to less-trusted callers or when operators expected workspace-only containment.
Workarounds
- Keep
tools.exec.applyPatch.enableddisabled if you do not needapply_patch. - Keep
tools.exec.applyPatch.workspaceOnlyat its secure default oftrue. - Restrict who can trigger tool execution (and which tools are allowlisted).
Configuration Note
tools.exec.applyPatch.workspaceOnly: false intentionally opts out of workspace containment and can re-enable outside-workspace writes/deletes.
Fix
- PR: https://github.com/openclaw/openclaw/pull/16405
- Merge commit:
5544646a09c0121fca7d7093812dc2de8437c7f1
Credits
Thanks to @p80n-sec for reporting this issue.
- Record
GHSA-r5fq-947m-xm57- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openclawnpm | before 2026.2.14 | 2026.2.14 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-32060 is a high vulnerability (CVSS 8.7) in Openclaw, published February 19, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.84%, the 58th percentile. Fixed in openclaw 2026.2.14.
References
github.com/openclaw/openclaw/security/advisories/GHSA-r5fq-947m-xm57
vulncheck.com/advisories/openclaw-path-traversal-in-apply-patch-via-crafted-paths
nvd.nist.gov/vuln/detail/CVE-2026-32060